Seven published safety engineering skills

Explore seven published WCGW skills for working with safety graphs, with related research credited below. Available through MCP.

Walk the Chain

Start with a hazard, safety goal, or requirement and follow its links through the safety graph to the evidence that supports it. Inspect the chain to see where the reasoning holds and where a missing link leaves a question open.

Research lineage. Orlena Gotel and Anthony Finkelstein analyzed requirements traceability, and Tim Kelly’s work on Goal Structuring Notation (GSN) shows how to connect claims to evidence. Gotel and Finkelstein (1994) · Kelly (1998)

Related research. ACCESS evaluates model-based assurance cases linked to engineering artifacts. GraphWalk studies how language models compose graph operations into inspectable traversal traces and evaluates the approach on synthetic graphs. ACCESS (2024) · Ghandi, Mahyar, and Klaiman (2026 preprint)

Shared Substrate

Look for physical dependencies that could compromise two supposedly independent channels, such as a shared power rail or cooling path. Matching annotations from the Ontology of Physics for Biology (OPB) surface candidates across differently named work items. Inspect the dependency paths to determine whether the channels rely on the same physical resource.

Research lineage. The U.S. Nuclear Regulatory Commission’s Reactor Safety Study examines common-mode failures. Peter Feiler’s work with the AADL Error Annex models fault propagation through shared resources. Daniel L. Cook, Maxwell L. Neal, Fred L. Bookstein, and John H. Gennari’s OPB work provides a vocabulary for representing physical dependencies. Reactor Safety Study, Appendix IV (1975) · Feiler (2012) · Cook et al. (2013)

Related research. Mohand Hammad, Ahmed Moro, and Mohamed Taher extract AUTOSAR software dependencies and use them to draft dependent-failure analyses for expert review. Hammad, Moro, and Taher (2026)

Change Walk

Compare two baselines and trace each change to the requirements, assumptions, and verification evidence it may affect. The result is a candidate re-verification set with reasons for carrying forward evidence that still applies.

Research lineage. Tim Kelly and John McDermid developed a systematic approach to assessing the impact of change on safety cases. Omar Jaradat and Iain Bate use safety contracts to guide re-analysis and re-verification after a change. Kelly and McDermid (1999 conference paper) · Kelly and McDermid (2001 journal article) · Jaradat and Bate (2017)

Related research. MMINT-A traces system-model changes into a GSN safety case and identifies parts of the argument that can be reused. Di Sandro, Murphy, Viger, and Chechik (2024)

Circular Argument Check

Check whether a safety claim depends on itself through a chain of supporting claims. Separately, flag support paths that end in rationale without reaching verification evidence so a reviewer can decide whether the claim needs that evidence.

Research lineage. John Rushby proposed automated checks for assurance-argument connectedness, non-circularity, and completeness. Rushby (2015, Section 5.1.1)

Related research. Assurance 2.0 addresses argument validity and soundness and represents defeaters explicitly so reviewers can examine what might undermine a claim or its support. Assurance 2.0 framework (2024) · Bloomfield, Netkachova, and Rushby (2024)

Standard Shift

Review an existing safety graph against a target standard to see which artifacts may carry over, which claims need a fresh argument, and where evidence is missing. Each reuse decision can be tied to the original artifact and the assumptions that make it applicable in the new context.

Research lineage. Alejandra Ruiz, Garazi Juez, Huáscar Espinoza, Jose Luis de la Vara, and Xabier Larrucea developed a systematic method for reusing safety certification artifacts across standards and evaluated it in a railway-to-avionics case study. Peter Ichekani Okoh and Thor Myklebust separately studied how hardware safety integrity and software safety levels map from ISO 26262 to IEC 61508. Ruiz et al. (2017) · Okoh and Myklebust, hardware (2024) · Okoh and Myklebust, software (2024)

Related research. UGAF-ITS maps obligations across three AI-governance frameworks and uses versioned evidence artifacts to support a shared audit package. Butt, Iqbal, and Iqbal (2026 preprint)

Assessor Dry Run

Turn gaps in traceability, verification, and the audit trail into questions a reviewer can work through before an assessment. Each question points to the graph finding that prompted it, so the team can inspect the relevant work item or evidence directly.

Research lineage. Tim Kelly proposed a structured process for reviewing assurance arguments. Faiz Ul Muram and Muhammad Atif Javed’s ATTEST automates parts of assurance-case review and update. Kelly (2007) · ATTEST presentation (2022) · ATTEST journal article (2023)

Related research. Gerhard Yu and colleagues formalize GSN review criteria as rules that guide LLM-assisted review. Scott Schnelle and colleagues describe a bottom-up assessment of how evidence supports individual safety claims. Yu et al. (2025 preprint) · Yu et al. (2026 journal article) · Schnelle et al. (2026)

STPA

Map controllers, control actions, and feedback, then identify unsafe control actions and the scenarios that could lead to loss. STPA (System-Theoretic Process Analysis) is essential for examining how software, people, and otherwise functioning components can interact unsafely: a command can be hazardous because of its context, timing, or duration. WCGW’s skill connects these findings to hazards, losses, and mitigating constraints in the same safety graph, then checks for missing hazard links and mitigations.

Research lineage. Nancy G. Leveson developed STAMP, the systems-theoretic foundation of STPA. Nancy G. Leveson and John P. Thomas’s handbook sets out the control-structure, unsafe-control-action, and loss-scenario analysis that this skill follows. Leveson and Thomas, STPA Handbook (2018)